1. Field
The invention disclosed and claimed herein generally pertains to a method and apparatus for evaluating rules which pertain to events in a data processing system, wherein the rules are evaluated by determining which of them are triggered or activated by an event. More particularly, the invention pertains to a method and apparatus of the above type wherein the given event has one or more string attributes which are used in the rule evaluation process.
2. Description of the Related Art
A typical enterprise information technology (IT) set up in a large organization is a complex system consisting of many individual but interacting components. The fact that most of these components are essentially independent of each other means that ensuring that they all work in harmony requires a lot of effort. Certain well known IT management products help an administrator monitor and maintain the health of the IT system by providing him or her with various indicators and alerts. The administrator can either use experience or some sort of knowledge base to make decisions based on events such as these indicators and alerts.
More advanced management systems are capable of automatically processing these types of events with digital knowledge sources such as policies and rules. Such systems can provide recommendations to the administrator, or even perform automated corrective actions. However, when IT systems grow in size, the size of the knowledge base, including event related rules and policies, also becomes very large. In order to reduce or avoid system down time in real-time scenarios, the IT management system must react quickly to generated events. With a very large number of rules, the approach provided by traditional rules evaluation methods (e.g. XPath, SQL and Impact) involves running each of the rules against the event, and most often evaluating the values of one or more attributes of the event. As the number of rules increase, the performance of this approach degrades significantly. The IT management system is no longer able to keep up with the pace of incoming events, or to maintain the health of the IT solution. Similar situations exist in expert systems which handle very large volumes of data. For example, retail organizations perform a lot of data processing to understand trends to assist with their strategy.
Matching algorithms such as the Rete algorithm improve on the above approach by using state saving and sharing of nodes with similar match conditions. In many systems, productions (or conditions) are based on text attributes of facts. The Rete algorithm is able to save states and merge productions, but, matching is still done individually, across fact attribute values. The Rete method still relies on individual comparisons for match conditions, which translates to one evaluation for each attribute and match condition pair. For these rule matching approaches, it is difficult to perform efficiently, if the attributes include significant string-based attributes. For the Rete algorithm, the matching approach still forces an exponentially increasing number of comparisons, as the data and match rules continue to increase.